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Foreword 

This Technical Specification (TS) has been produced by the ETSI 3' Generation Partnership Project (3GPP). 

The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or 
GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. 

The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under www.etsi.org/kev . 

ETSI is a Custodian of the 3GPP Confidentiality and Integrity Algorithms f8 & f9, which have been developed through 
the collaborative efforts of the European Telecommunications Standards Institute (ETSI), the Association of Radio 
Industries and Businesses (ARIB), the Telecommunications Technology Association (TTA), the Tl Committee. 

The f 8 & f9 Algorithms Specifications may be used only for the development and operation of 3G Mobile 
Communications and services. Every Beneficiary must sign a Restricted Usage Undertaking with the Custodian and 
demonstrate that he fulfills the approval criteria specified in the Restricted Usage Undertaking. 

Furthermore, Mitsubishi Electric Corporation holds essential patents on the Algorithms. The Beneficiary must obtain a 
separate IPR License Agreement from Mitsubishi Electronic Corporation Japan. 

Licensing procedure with ETSI is the following: 

Every Beneficiary must send to the ETSI Secretariat two signed paper copies of the 3GPP Restricted Usage Undertaking 
with the Administrative Charge. Upon receipt of payment the Beneficiary will then receive one copy of the Restricted 
Usage Undertaking duly signed by ETSI by express mail. 

For further details of these procedures, see http://www.etsi.org/ . 
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Foreword 



rd , 



This Technical Specification has been produced by the 3 Generation Partnership Project (3GPP). 

The 3GPP Confidentiality and Integrity Algorithms f8 & f9 have been developed through the collaborative efforts of the 
European Telecommunications Standards Institute (ETSI), the Association of Radio Industries and Businesses ( ARIB), 
the Telecommunications Technology Association (TTA), the Tl Committee. 

The f 8 & f9 Algorithms Specifications may be used only for the development and operation of 3G Mobile 
Communications and services. Every Beneficiary must sign a Restricted Usage Undertaking with the Custodian and 
demonstrate that he fulfills the approval criteria specified in the Restricted Usage Undertaking. 

Furthermore, Mitsubishi Electric Corporation holds essential patents on the Algorithms. The Beneficiary must get a 
separate IPR License Agreement from Mitsubishi Electronic Corporation Japan. 

For details of licensing procedures, contact ETSI, ARIB, TTA or Tl. 



The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 

This specification has been prepared by the 3GPP Task Force, and gives black-box test data for the algorithm set. The 
test data has been selected to give a high degree of confidence that the implementation is correct. However, no claim is 
made that conformance with this test data guarantees a correct implementation. 

This document is the last of four, which between them form the entire specification of the 3GPP Confidentiality and 
Integrity Algorithms: 

3GPP TS 35.201: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 1:/S and 
f9 Specification". 

3GPP TS 35.202: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 2: 
KASUMI Specification". 

3GPP TS 35.203: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 3: 
Implementors' Test Data". 
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- 3GPP TS 35.204: "3rd Generation Partnership Project; Technical Specification Group Services and 
System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; 
Document 4: Design Conformance Test Data". 

This document is purely informative. The normative part of the specification of the /S (confidentiality) and the/9 
(integrity) algorithms is in the main body of Document 1 . The normative part of the specification of KASUMI is found 
in document 2. 
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Scope 



This specification gives black-box test data for the algorithm set. The test data has been selected to give a high degree 
of confidence that the implementation is correct. However, no claim is made that conformance with this test data 
guarantees a correct implementation. 



1 Outline of the design conformance test data 

Section 2 introduces the algorithms and describes the notation used in the subsequent sections. 
Section 3 provides test data for the Confidentiality Algorithm/5. 
Section 4 provides test data for the Integrity Algorithm/9. 



1.1 References 



The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[1] 3GPP TS 33.102 version 3.2.0: "3rd Generation Partnership Project; Technical Specification 

Group Services and System Aspects; 3G Security; Security Architecture". 

[2] 3GPP TS 33.105 version 3.1.0: "3rd Generation Partnership Project; Technical Specification 

Group Services and System Aspects; 3G Security; Cryptographic Algorithm Requirements". 

[3] 3GPP TS 35.201: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 1: f8 and f9 Specification". 

[4] 3GPP TS 35.202: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 2: KASUMI Specification". 

[5] 3GPP TS 35.203: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 3: Implementors' Test Data". 

[6] 3GPP TS 35.204: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 4: Design Conformance Test Data". 

[7] ISO/IEC 9797-1:1999: "Information technology - Security techniques - Message Authentication 

Codes (MACs)". 



£75/ 



3GPP TS 35.204 version 3.1.2 Release 1999 7 ETSI TS 135 204 V3.1.2 (2001-08) 



Introductory information 



2.1 Introduction 

Within the security architecture of the 3GPP system there are two standardised algorithms; a confidentiality algorithm 
f8, and an integrity algorithm /9. These algorithms are specified in a companion document [3]. 

This document provides sets of input/output test data for 'black box' testing of physical realisations of the/5 and/9 
algorithms. 

2.2 Radix 

Unless stated otherwise, all test data values presented in this document are in hexadecimal. 

2.3 Bit/Byte ordering 

All data variables in this specification are presented with the most significant bit (or byte) on the left hand side and the 
least significant bit (or byte) on the right hand side. 

2.4 Presentation of input/output data 

The basic data processed by the/S and/9 algorithms are bit streams. In general in this document the data is presented 
in hexadecimal format as bytes, thus the last byte shown as part of an input or output data stream may include between 
and 7 bits that are ignored once the LENGTH parameter is taken into account. (The least significant bits of the byte 
are ignored). 

2.5 Coverage 

For each of the algorithms the test data have been selected such that, provided the entire set of tests is run: 

Each key bit will have been in both the '1' and the '0' states. 

- Each bit of the initialisation fields (COUNT, FRESH, BEARER, DIRECTION) will have been in both the ' 1 ' 
and the '0' states. 

Every entry in the internal S-boxes will have been used. 



3 Confidentiality algorithm f8 

3.1 Overview 

The test data sets presented here are for the/8 confidentiality algorithm. 

3.2 Format 

Each test set shows the various inputs to the algorithm including the plain text data stream to be encrypted/decrypted. 
(The length field is in decimal). 

The fields are: 

Key =CK[0]...CK[127] 

Count = COUNT[0] . . .COUNT[3 1] 
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Bearer = BEARER[0] . . .BEARER[3] 

Direction = DIRECTION[0] 

Length = Length of data in decimal 

Plaintext = PT[0] PT[1] PT[Length-l] 

This is followed by the modified input data, i.e. it is the bit-wise exclusive-or of the corresponding keystream and the 
input data to the algorithm. 

Ciphertext = CT[0] CT[l]....CT[Length-l] 

As this is a stream cipher it is purely a matter of context whether the operation is regarded as "encryption" or 
"decryption". For the purposes of this document we regard the input as Plaintext and the output as Ciphertext. 

The first test set is shown twice, once in binary format, once in hexadecimal format. This is to explicitly show the 
relationship between the binary data and the hexadecimal presentation. 

The remainder of the test sets are presented in hexadecimal format only. 

3.3 Test Set 1 

3.3.1 Binary Representation 

Key= 1101001111000101110101011001001000110010011111111011000100011100 
0100000000110101110001100110100000001010111110001100011011010001 

Count = 00111001100010100101100110110100 

Bearer = 10101 

Direction = 1 

Length = 253 bits 

Plaintext : 

1001100000011011101001101000001001001100000110111111101100011010 

1011010010000101010001110010000000101001101101110001110110000000 

1000110011100011001111100010110011000011110000001011010111111100 

0001111100111101111010001010011011011100011001101011000111110 

ciphertext : 

1100101000001010011000001011010000101001100111100110100101010100 

1101101111110111011010000110111001000110111101000100000110010000 

1101110010000001101100000111010000000100010010000001001110110101 

0000101010110001111111100100011001011001011110111010001100111 

3.3.2 Hexadecimal Representation 

Key = D3C5D592327FB11C4035C6680AF8C6D1 

Count = 398A59B4 

Bearer = 15 

Direction = 1 

Length = 253 bits 

Plaintext : 

981BA6824C1BFB1A B48547202 9B71D80 8CE33E2CC3C0B5FC 1F3DE8A6DC66B1F0 

Ciphertext : 

CA0A60B4299E6954 DBF? 686E4 6F441 90 DC81B074044813B5 0AB1FE4 6597BA338 
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3.4 



Test Set 2 



2BD64 5 9F82C4 4 0E0 952C4 9104 805FF4 8 

C675A64B 

OC 

1 

798 bits 



Key 

Count 

Bearer 

Direction 

Length 

Plaintext : 

7EC612 72 7 4 3BF161 4 72 64 4 6A6C38CED1 

922B03450D3A9 975 E5BD2EA0EB55AD8E 

5 9B7BDFD3 9BEF4B2 4 84583D5AFE082AE 

9B134880 



66F6CA76EB543004 
1B199E3EC4316020 
E638BF5FD5A60619 



4286346CEF130F92 
E9A1B285E7627953 
3901A08F4AB41AAB 



Cipher text : 

1061793DAAACBE40 C9431E2 92B7FF4 94 96DB0D31CE24710C 01ACFF1B2C441FA9 

3BB3BD65DE18027A 14CCA571A42E8B12 74AE30AC411AB6AF D88F924E65F9812D 

FA80EF8E9A7EA753 391D09F480D9147C B39C23A1ACB9AC9B 2A6B4709F7E6DD84 

D8FA59A4 



3.5 



Test Set 3 



0A8B6BD8D9B08B08D64E32D1817777FB 

544D49CD 

04 



310 bits 



Key 

Count 

Bearer 

Direction 

Length 

Plaintext : 

FD40A41D370A1F65 745095687D47BA1D 36D234 9E23F64439 2C8EA9C4 9D40C132 

71AFF264D0F248 



Cipher text : 

22B707A481F264BE 691 994C2A201354D 5741A2E6B4 624EE9 DF30D8D945351 65B 

D439223EBBD074 



3.6 



Test Set 4 



Key 

Count 

Bearer 

Direction 

Length 

Plaintext : 

FB1B96C5C8BADFB2 



AA1F95AEA533BCB32EB63BF52D8FS 

72D8C671 

10 



31A 



1 

1022 bits 



E8E8EDFDE78E57F2 AD81E74103FC430A 534DCC37AFCEC70E 



1517BB06F27219DA E4 9022DDC47A068D E4C94 96A951A6B09 EDBDC864C7ADBD74 
0AC50C022F3082BA FD22D781 97C5D508 B977BCA13F32E652 E74BA72857 6077CE 
628C535E87DC6077 BA07D2 9068590C8C B5F1088E082CFA0E C961302D69CF3D44 

Ciphertext : 

5C6FD2D34BE8B0F5 212 600BD758881F7 6C4F11A5C3D42028 A9A02 9F2E0630454 

829AA0A69D58D023 02E8DB3D6E9FF350 09B3595984BEB400 31271BF78727270B 

9608520036125AD6 8A28213513CBA08C 7BB9EA966C0713FD 2DFFE2BADC6287CF 

79B244B7236124FB 51B863684C4D89D1 940541D356809022 12081FE694DC4594 
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3.7 Test Set 5 



9 618AE4 68 91F8 657 8EEBE90EF7A12 02E 

C675A64B 

OC 

1 

1245 bits 



Key 

Count 

Bearer 

Direction 

Length 

Plaintext : 

8DAA17B1AE05052 9 C682 7F2 8C0EF6A12 

122 67FECAEFC4 501 7 4D7 6D9F9AA7 7 55A 

0A8B6BD8D9B08B08 D64E32D1817777FB 

FD4 0A41D37 0A1F65 7 4 50 95 687D4 7BA1D 



42E93F8B314FB18A 
30CD90A9A5874BF4 
544D49CD49720E21 
36D2349E23F64439 



77F790AE049FEDD6 
8EAF70EEA3A62A25 
9DBF8BBED33904E1 
2C8EA9C49D40C132 



71AFF264D0F24841 D6465F0S 



6FF84E6 5FC517C53EFC3363 C38492A8 



Ciphertext : 

AAF8E8B34 9FBABB9 5C621DE6FB51 67 4 4 



44EEA 
7A57D3509BA16B 



054AE7CFA946F99 

B759FFE3 E22D6E17BD9E707 9 CC54E8D4 92DBFDE7 

15FDDDD638E2 52F4 371E4 71D1B3 9B415 



6C26005345A1A2AF 
9E84043849821A24 
8B47F14D037BBD28 



37804134AD493BFC 140E437F5EBF9C2 9 D5D8A5816F92 6AA2 7 6E9A743A62141AD 
EB653BD2963C9F54 1F5E1334B77592B1 ADED443672282801 32A747D8 



3.8 



Test Set 6 



Key = 54F4 

Count = ACA4 

Bearer = OB 

Direction = 

Length = 2837 

Plaintext : 

40981BA6824C1BFB 

1AB485472029B71D 

808CE33E2CCCBFC6 

FA16BB11ADAE2488 

762DD0C2C9CD68D4 

CABE7D9F898A411B 

5E4CEC034C73E605 

CD8C87202364B8A6 

9FE4189F15420026 

5ABE65272AF607AD 

888138616B681262 

B09550 



E2E04C837 8 6EEC8FB5ABE8E3 65 6 6 
F50F 



bits 

4286B299783DAF44 
36BD1A3D90DC3A41 
34E1B259060876A0 
79FE52DB2543E53C 
496A792508614014 
FDB84F68F6727B14 
B4310EAAADCFD5B0 
87954CB05A8D4E2D 
FE4CD12104932FB3 
A1BE65A6B4C9C069 
F954D0E771174878 



2C099F7AB0F58D5C 
B46D51672AC4C966 
FBB5A437EBCC8D31 
F445D3D828CE0BF5 
B13B6AA51128C18C 
99CDD30DF0443AB4 
CA27FFD89D144DF4 
99E73DB160DEB180 
8F735340438AAF7E 
3234092C4D018F17 
0D92291D86299972 



8E46B104F08F01B4 
3A2BE063DA4BC8D2 
C19E4454318745E3 
C560593D97278A59 
D6A90B87978C2FF1 
A66653330BCBA110 
792759427C9CC1F8 
AD0841E96741A5D5 
CA6FD5CFD3A195CE 
56C6DB9DC8A6D80B 
DB741CFA4F37B8B5 



Ciphertext : 

BFB39672186E62B7 

679207F035194553 

8566B0F646394892 

408FCA9EC4A38869 

19590CA8D25F9AFD 

B1B7F1945AEA83FA 

6AFA95A3E9DB5C47 

69576AA958CE5909 

48E7BAE30D5BB21D 

B6D7530E3B85FA63 

A41F43ABEFD48D70 

2261B0 



7FB39F9278A8AEA6 
DDF973E830C3E249 
D443F394DA13DAC2 
1C513CFED22357B2 
5BB00FB081EAD4BD 
C3B2208281B30883 
3CD054D2E0A7F080 
3ACB8A5F72096A7F 
CABD217CB55B899F 
1C65C3402A87D98F 
CCC9C21DDF02792B 



0468E05A2BB57E8B 
4EF6C9449FDC0735 
05D84B2628191A0C 
F7742FB8D5CE550E 
A0FAC5DC78F79771 
E590196D6499B431 
CB5967C709DE78EC 
E671C3717B1B514A 
A7D8EA0557F672E4 
3B6FB971FCCB1AF1 
8EE8A77988CDC317 



6D6AA1B05AE83147 
1F8B453EEE70001D 
574E974507A9A9F3 
03CAA9CFFFF54100 
8B6AE21BF9D0C443 
7EA97E080830C204 
8435CAE9B3617655 
0AE7D7792E44F17C 
36BE18350D58C65F 
A6592DF2CCFE6893 
1046C515401ABB13 



Integrity algorithm f9 



4.1 



Overview 



The test data sets presented here are for the/9 integrity algorithm. 

Each test set shows the various inputs to the algorithm including the plain text data stream to be 'MAC'd. The length 
field is in decimal. 

The fields are: 

Key = IK[0]...IK[127] 
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Count = COUNT-I[0]...COUNT-I[31] 

Fresh = FRESH[0]...FRESH[31] 

Direction = DIRECTION[0] 

Length = Length of data in decimal 

Message = MESSAGE[0]...MESSAGE[Length-l] 

This is followed by the calculated value for MAC -I. 

Output =MAC-I[0]...MAC-I[31] 

The first test set is shown twice, once in binary format, once in hexadecimal format. This is to explicitly show the 
relationship between the binary data and the hexadecimal presentation. 

The remainder of the test sets are presented in hexadecimal format only. 

4.2 Test Set 1 



4.2.1 Binary Representation 



Key= 0010101111010110010001011001111110000010110001011011001100000000 
1001010100101100010010010001000001001000100000011111111101001000 

Count = 00111000101001101111000001010110 

Fresh = 10111000101011101111110110101001 

Direction = 

Length = 88 bits 

Message : 

0011001100110010001101000110001001100011001110010011100001100001 

001101110011010001111001 

Output: 01000110111000000000110101001011 

4.2.2 Hexadecimal Representation 

Key = 2BD6459F82C5B300952C49104881FF48 

Count = 38A6F056 

Fresh = B8AEFDA9 

Direction = 

Length = 88 bits 

Message : 

3332346263393861 373479 

Output: 46E00D4B 



4.3 Test Set 2 



Key = 7E5E94431E11D73828D739CC6CED4573 

Count = 36AF6144 

Fresh = 9838F03A 

Direction = 1 

Length = 254 bits 

Message : 

B3D3C9170A4E1632 F60F861013D22D84 B72 6B6A278D802D1 EEAF1321BA592 9DC 

Output: 2BEEF3AC 
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4.4 



Test Set 3 



Key 

Count 

Fresh 

Direction 

Length 

Message : 

BBB057038809496B CFF 



D3419BE821087ACD0212 3A92 4 803335 9 

C7590EA9 

57D5DF7D 



511 bits 



5D6FBC8CE5B1 35A06B1 66054F2D5 65BE8ACE75DC851E 



0BCDD8F07141C495 872FB5D8C0C66A8B 6DA556663E4E4 612 05D84580BEE5BC7E 
Output: 02158170 



4.5 



Test Set 4 



83FD2 3A2 4 4A7 4CF358DA3019F1722 635 

3 6AF614 4 

4F302AD2 

1 

768 bits 



Key 

Count 

Fresh 

Direction 

Length 

Message : 

35C68716633C66FB 750C266865D53C11 EA05B1E9FA4 9C839 8D48E1EFA5909D39 

47902837F5AE96D5 A05BC8D61CA8DBEF 1B13A4B4ABFE4FB1 006045B674BB5472 

9304C382BE53A5AF 0555617 6F6EAA2EF 1D05E4B083181EE6 74CDA5A485F74D7A 



Output: 95AE41BA 



4.6 



Test Set 5 



6832A65CFF4473621EBDD4BA2 6A921FE 

3 6AF614 4 

9838F03A 



383 bits 



Key 

Count 

Fresh 

Direction 

Length 

Message : 

D3C5383962682071 7765667620323837 636240981BA6824C 1BFB1AB48547202 ? 

B71D808CE33E2CC3 C0B5FC1F3DE8A6DC 



Output: 8B2D570F 



4.7 



Test Set 6 



5D0A80D8134AE19 67 7 82 4B671E838AF4 

7827FAB2 

A56C6CA2 

1 

2558 bits 



Key 

Count 

Fresh 

Direction 

Length 

Message : 

7 0DEDF2DC4 2C5CBD 3A9 6F8A0B11418B3 

153BE2D3C0 6DFDB2 D16E9C357158BE6A 

D58 9537 30FF30C9E C4 7 0FFCD6 63DC34 2 

37 31F8B4BAA8D1A8 9C0 6E81199A97162 

C399993FC77 394F9 E0 972 0A811850EF2 

012A00BB413B9CB8 188A7 03CD6BAE31C 

7C9EF8DEC00 94E53 37 634 7 8D58D2C5F5 

E62CE7 4 007E9 91E3 7EA823FA0FB21923 

1A9C7 30C52FF7 2D9 D308EEDBAB21FDE1 

A154 64EAA7 33385D BBEB6FD7 350 9B857 



608D5733604A2CD3 
41D6B861E491DB3F 
01C36ADDC0111C35 
27BE344EFCB436DD 
3B2EE05D9E617360 
C67B34B1B00019E6 
B827A0148C5948A9 
B79905B733B631E6 
43A0EA17E23EDC1F 
E6A419DCA1D8907A 



6AABC70CE3193BB5 
BFEB518EFCF048D7 
B38AFEE7CFDB582E 
D0F096C064C3B5E2 
9D86E1C0C18EA51A 
A2B2A690F02671FE 
6931ACF84F465A64 
C7D6860A3831AC35 
74CBB3638A2033AA 
F977FBAC4DFA35EC 



Output: 3AE4BFF3 
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Annex A (informative): 
Change history 



Change history 


Date 


TSG# 


TSG Doc. 


CR 


Rev 


Subject/Comment 


Old 


New 


12-1999 








- 


ETSI SAGE Publication (restricted) 




SAGE 
vl.O 


09-2000 


SA_07 








Approved by TSG SA and placed under change control 


SAGE 
vl.O 


3.1.0 


07-2001 








- 


Word version received: Re-formatted into 3GPP TS format (MOO) 
No technical change from version 3.1 .0. 


3.1.0 


3.1.1 


08-2001 










Addition of Mitsubishi IPR information in Foreword and correction of 
reference titles. No technical change from version 3.1.0. 


3.1.1 


3.1.2 
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